I have a log file which contains header (printed once per file) & body (multiple log blocks) as shown below.
Server name = abcdefgh123
Time = 07/09/24 12:23:22 AM
Country = IN
Total = 50
Status = Green
Country = UK
Total = 23
Status = Yellow
Country = US
Total = 10
Status = Red
I am pushing logs with help of filebeat.
Log flow - Filebeat -> Logstash -> Elasticsearch.
Here I am trying to aggregate header with each body block, but its failing as all the logs are sent as single event.
Please help if anyone have faced this and know the solution.